---
title: Repository-level dependency management configuration not detected
description: >-
  Looks for a local Dependabot or Renovate configuration file at the repository
  root without validating its contents.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/missing-dependency-security-automation
  md: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/missing-dependency-security-automation.md
---

# Repository-level dependency management configuration not detected

Looks for a local Dependabot or Renovate configuration file at the repository root without validating its contents.

| Detail | Value |
| - | - |
| Check ID | `MISSING_DEPENDENCY_SECURITY_AUTOMATION` |
| Severity | Low |
| How it runs | Deterministic scan |

***

## How to fix

Add a Dependabot or Renovate configuration file at the repository root, or verify existing coverage.

The scan looks for `.github/dependabot.yml`, `renovate.json`, and the other conventional Renovate filenames, including the `.github/`, `.gitlab/`, and `.renovaterc` variants. It reads the filename only: a file that's present but misconfigured, disabled, or scoped to a directory your app doesn't live in still passes.

## .github/dependabot.yml

```yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
```

***

## Related

* [`shopify app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), the command that runs this check
* [All app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks)

***